Bug 348981: Crash toggling designMode.

This reverts the patch from bug 347200 and instead fixes that problem a
different way to avoid exposing crashes.
r+sr=bzbarsky

content/html/document/src/nsHTMLDocument.cpp

@@ -132,6 +132,7 @@
 #include "nsBidiUtils.h"
 
 #include "nsIEditingSession.h"
+#include "nsIEditor.h"
 #include "nsNodeInfoManager.h"
 
 #define DETECTOR_CONTRACTID_MAX 127
@@ -3679,30 +3680,45 @@ nsHTMLDocument::SetDesignMode(const nsAString & aDesignMode)
     return NS_ERROR_FAILURE;
 
   if (aDesignMode.LowerCaseEqualsLiteral("on") && !mEditingIsOn) {
-    // Turn the member variable on now, so that when editor calls back to find
-    // out whether to spellcheck, we provide the right answer
-    mEditingIsOn = PR_TRUE;
-
     rv = editSession->MakeWindowEditable(window, "html", PR_FALSE);
-    if (NS_FAILED(rv)) {
-      mEditingIsOn = PR_FALSE;
-      return rv;
-    }
 
-    // Set the editor to not insert br's on return when in p elements by
-    // default.
-    PRBool unused;
-    rv = ExecCommand(NS_LITERAL_STRING("insertBrOnReturn"), PR_FALSE,
-                     NS_LITERAL_STRING("false"), &unused);
-    if (NS_FAILED(rv)) {
-      // Editor setup failed. Editing is is not on after all.
-      mEditingIsOn = PR_FALSE;
-      editSession->TearDownEditorOnWindow(window);
+    if (NS_SUCCEEDED(rv)) {
+      // now that we've successfully created the editor, we can
+      // reset our flag
+      mEditingIsOn = PR_TRUE;
+
+      // Set the editor to not insert br's on return when in p
+      // elements by default.
+      PRBool unused;
+      rv = ExecCommand(NS_LITERAL_STRING("insertBrOnReturn"), PR_FALSE,
+                       NS_LITERAL_STRING("false"), &unused);
+
+      if (NS_FAILED(rv)) {
+        // Editor setup failed. Editing is is not on after all.
+
+        editSession->TearDownEditorOnWindow(window);
+
+        mEditingIsOn = PR_FALSE;
+      } else {
+        // Resync the editor's spellcheck state, since when the editor was
+        // created it asked us whether designMode was on, and we told it no.
+        // Note that reporting "yes" (by setting mEditingIsOn true before
+        // calling MakeWindowEditable()) exposed several crash bugs (see bugs
+        // 348497, 348981).
+        nsCOMPtr<nsIEditor> editor;
+        rv = editSession->GetEditorForWindow(window, getter_AddRefs(editor));
+        if (NS_SUCCEEDED(rv)) {
+          editor->SyncRealTimeSpell();
+        }
+      }
     }
   } else if (aDesignMode.LowerCaseEqualsLiteral("off") && mEditingIsOn) {
     // turn editing off
-    mEditingIsOn = PR_FALSE;
     rv = editSession->TearDownEditorOnWindow(window);
+
+    if (NS_SUCCEEDED(rv)) {
+      mEditingIsOn = PR_FALSE;
+    }
   }
 
   return rv;